Pith. sign in

REVIEW 4 major objections 6 minor 45 references

Medical Multimodal Model Stealing Attacks via Adversarial Domain Alignment

T0 review · 4 major / 6 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read With black-box access and public natural images, an attacker can replicate a medical multimodal large language model's radiology report generation, reaching up to 99% of the victim's clinical efficacy without any medical data.

desk verdict First practical stealing attack on medical MLLMs; the empirical result holds up, but the 'domain alignment' explanation is shakier than the data warrant. read the letter →

arxiv 2502.02438 v1 pith:V5E5ITRR submitted 2025-02-04 cs.CR cs.AI

Yaling Shen , Zhixiong Zhuang , Kun Yuan , Maria-Irina Nicolae , Nassir Navab , Nicolas Padoy , Mario Fritz This is my paper · ORCID
classification cs.CRcs.AI
keywords medicalmultimodallargelanguagemodelsmodelstealingadversarialdomainalignmentradiologyreportgenerationblack-boxattackdata-freeextractionCIFAR-100FGSM
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces ADA-STEAL, a model-stealing attack that copies a medical multimodal large language model's radiology report generation from black-box queries alone. The central claim is that data augmentation with adversarial noise is enough to bridge the distribution gap between natural images and the victim's medical image distribution, so the attacker never needs medical data. Using CIFAR-100 images, an oracle LLM to diversify reports, and FGSM perturbations computed on the attacker's own surrogate model, the stolen model reaches between 74% and 99% of the victim's clinical efficacy (RadGraph-Score) on IU X-RAY and MIMIC-CXR.

What carries the argument

The load-bearing mechanism is the iterative Adversarial Domain Alignment loop built on the hypothesis $X = M_a^{-1}(\bar{Y})$: the attacker's surrogate $M_a$, trained on victim pseudo-labels, is used as a differentiable proxy to invert the image-to-report mapping, so FGSM noise on natural images pushes them toward images that elicit the oracle's diversified medical reports from the victim. FGSM (fast gradient sign method) provides the perturbation $\delta = \epsilon \cdot \text{sign}(\nabla_{X_a} L(M_a(X_a), \bar{Y}))$, and the oracle LLM provides the medically relevant target reports $\bar{Y}$ that the perturbation is optimized toward.

What would settle it

Run the identical ADA-STEAL pipeline with ImageNet or Places365 instead of CIFAR-100 while keeping the victim, oracle, and epsilon fixed: if the RadGraph-Score ratio on IU X-RAY and MIMIC-CXR drops well below 0.85, the 'natural images suffice' claim is specific to CIFAR-100 rather than a general property of natural images.

Watch

Extended reading notes

Core claim

ADA-STEAL is the first functionality-stealing attack against medical MLLMs for radiology report generation. The attacker trains a surrogate model on pseudo-labels obtained by querying the victim with natural images, then iteratively fine-tunes the surrogate on those labels, uses an open-source text-only LLM prompted with chest X-ray anatomy to synthesize diverse medical reports, and computes an FGSM perturbation against the surrogate, treating the surrogate as an approximate inverse of the victim mapping. The perturbed images are queried on the victim and added to the transfer set. The paper reports that this pipeline yields a stolen model whose RadGraph-Score reaches 0.99 times the victim's on IU X-RAY and 0.90 times on MIMIC-CXR, outperforming a direct Knockoff Nets adaptation.

Load-bearing premise

The attack works only if the attacker's surrogate model is a faithful-enough proxy for the victim that FGSM noise computed against the surrogate transfers to the victim and elicits diverse, medically relevant reports.

Editorial extensions

If this is right

  • Black-box access to a medical MLLM's report-generation API is enough to build a functional clone; no medical images, labels, or domain expertise are required.
  • Existing model-stealing defenses that add noise to logit predictions do not apply here because the attacker only receives discrete generated text.
  • The same recipe could be extended to other MLLM tasks by swapping the oracle prompt, such as image captioning in other specialized domains.
  • Medical institutions cannot rely on data scarcity or privacy regulations to protect MLLM intellectual property once the model is served publicly.
  • The reported 0.90–0.99 RAD-S ratios imply the stolen model is clinically near-equivalent on radiology report generation, making downstream attacks such as transfer jailbreaks more plausible.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The counterintuitive result that starting from real MIMIC-CXR images performs worse than CIFAR-100 suggests the adversarial perturbation is not literally aligning domains but rather creating surrogate features the victim happens to respond to; that would mean the attack exploits quirks of the victim's decision boundary rather than true domain transfer.
  • The 'data-free' framing depends on an unstated external resource: the oracle LLM's medical knowledge. If a future attack replaced the oracle with a generic, non-medical text generator, the high RAD-S ratios would likely collapse, so 'no medical data' really means 'no medical imaging data.'
  • A direct testable extension: run the same pipeline with ImageNet or Places365 instead of CIFAR-100; if the RAD-S ratio stays high, the 'natural images suffice' claim generalizes, and if it fails, the effect is specific to CIFAR-100's particular class structure.
  • The paper's Table 4 shows random Gaussian noise as a query source fails completely, which suggests the perturbation is not merely adding texture but must operate on structured natural-image features, constraining which public data an attacker could practically use.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes ADA-STEAL, a black-box model stealing attack against medical multimodal large language models (MLLMs) for radiology report generation. The attacker queries the victim with natural images (e.g., CIFAR-100) to obtain pseudo-reports, then iteratively (I) fine-tunes a surrogate MLLM on these pseudo-labels, (II) enriches the pseudo-reports using an open-source LLM oracle that composes typical chest X-ray findings, and (III) generates FGSM perturbations on the query images to elicit more diverse, medically relevant victim outputs. Experiments on IU X-RAY and MIMIC-CXR with CheXagent as victim and IDEFICS/CHEXAGENT* as attacker report ROUGE-L, BERTScore, and RadGraph-Score; ADA-STEAL consistently outperforms a Knockoff baseline and reaches up to 0.99x of the victim's RAD-S on IU X-RAY.

Significance. The attack is timely and, if validated, has practical security implications: it demonstrates that a medical MLLM can be functionally replicated without any medical training data, using only public natural images and a publicly available oracle LLM. The paper's strengths include evaluation on two standard radiology datasets, two attacker architectures, ablations of the oracle and of the adversarial component, a sensitivity study over epsilon, and a careful discussion of why CheXbert is unreliable for out-of-distribution reports. The central explanatory claim that adversarial noise performs 'domain alignment' is, however, not directly supported and is in tension with one of the paper's own experiments.

major comments (4)
  1. [Domain Alignment (Eq. 6) and Table 4] The paper's central claim that the FGSM perturbation 'overcome[s] the data distribution gap' is contradicted by the authors' own distribution-swap experiment. At epsilon=0.05, starting from Pa=MIMIC-CXR, i.e., the victim's own training distribution, performs substantially worse than starting from Pa=CIFAR-100 (RAD-S 7.9 vs 14.1 on MIMIC-CXR; 10.4 vs 22.3 on IU X-RAY). The explanation given in Section 'Image distribution Pa' — that adversarial images on actual CXRs 'distort the image distribution from the actual CXRs' — states that the perturbation moves inputs out of distribution, which is the opposite of the alignment mechanism claimed in the abstract and in Eq. (4). The authors should either provide direct evidence that the perturbation closes the distribution gap (e.g., feature-space distance between Pa+delta and Pv, or a plot analogous to Figure 5 but showing image embeddings) or revise the claim to state that the benefit comes from a transferable perturbation that elicits diverse victim outputs, not from domain alignment.
  2. [Domain Alignment, Eq. (6)] The method relies on the assumption that the surrogate Ma is a faithful proxy for computing gradients that transfer to the victim Mv, but no transferability measurement is reported. The authors do not quantify how often the victim's output for Xa+delta differs from its output for Xa, nor whether the differences correspond to the oracle-desired findings. A minimal experiment would compare ADA-STEAL's adversarial perturbation to random noise of the same L-infinity norm, or measure label flips/test-time agreement between Ma and Mv on the perturbed query set. Without such evidence, the contribution of the 'domain alignment' component to the attack's success is not isolated.
  3. [Tables 3 and 4, Figure 3] All reported metrics are from a single run, without error bars. Some comparisons in Table 3 are close (e.g., CHEXAGENT* +KNOCKOFF vs +ADA-STEAL on MIMIC-CXR RG-L: 23.2 vs 24.7; BERT-S 43.7 vs 44.5). The claimed advantages would be more convincing if the main tables reported at least 3 random seeds or bootstrap confidence intervals, since MLLM fine-tuning is known to be sensitive to initialization and data ordering.
  4. [Implementation details] The oracle report composition probabilities (80% abnormal, 10% normal, 10% original) and the oracle prompt To are introduced without sensitivity analysis. Since the report enrichment is one of the two core novel components, the authors should report how the attack performance varies with these probabilities (e.g., 50/25/25 or 100/0/0) or provide a rationale for the chosen values.
minor comments (6)
  1. [Throughout] The acronym 'ADA-STEAL' is inconsistently spaced (e.g., 'ADA-S TEAL'); please standardize.
  2. [Ablative analysis] The text contains the phrase 'abrogation study'; this should be 'ablation study'.
  3. [Table 4] The row Pa=∅ is not defined in the notation table; clarify that this row corresponds to the untuned open-access IDEFICS model, not an actual attacker distribution.
  4. [Domain Alignment, Eq. (4) vs Eq. (6)] Eq. (4) includes L(Mv(Xa+delta), \bar{Y}), but the implementation in Eq. (6) replaces Mv with Ma; the approximation should be stated explicitly in the text rather than only in the narrative of the domain alignment section.
  5. [Figure 3a] The caption says 'performance of ADA-STEAL on IDEFICS with different ε', but the curves may show ratios to the victim; please clarify whether the y-axis is absolute or normalized.
  6. [Extended scope] The discussion states that extending to stochastic decoding 'sees no fundamental limitation' without supporting evidence; this is speculative and should be labeled as such.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: ADA-STEAL is evaluated on held-out external radiology benchmarks, and its components are not defined in terms of the test outcomes.

full rationale

The derivation chain is: query the victim MLLM with natural images, train an attacker surrogate, use oracle LLM reports as targets for FGSM perturbations on the surrogate, query the victim with the perturbed images, fine-tune the attacker on the resulting victim pseudo-labels, and finally measure performance on held-out MIMIC-CXR and IU X-RAY test sets with ROUGE-L, BERTScore, and RadGraph. None of these steps fits a parameter to the evaluation labels: the oracle reports are generated from a text prompt without image input, and the pseudo-labels are genuine black-box victim outputs obtained under the fixed query budget. The only self-citation (Zhuang, Nicolae, and Fritz 2024) supports a general claim about query-distribution alignment and is not load-bearing for the attack construction. The 'domain alignment' hypothesis X = M^{-1}_a(Ybar) is an ansatz, but it is not circular because the resulting perturbation is then validated against the actual victim and on external test data. Table 4's counterintuitive result that starting from MIMIC-CXR performs worse than CIFAR-100 may weaken the mechanistic 'domain alignment' explanation, but that is a correctness or evidence concern rather than circularity: the measured attack gain is not an algebraic consequence of the paper's own definitions or fitted inputs. The score of 1 reflects one peripheral self-citation with no circular dependence; the central stealing result stands or falls on independent empirical evaluation.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central method relies on several domain assumptions (deterministic victim, known prompt, proxy transfer, oracle relevance) and hand-set hyperparameters (epsilon, report composition, query budget). No new physical or mathematical entities are introduced; the oracle model is an existing open-source LLM.

free parameters (5)
  • adversarial noise budget epsilon = 0.2 (main results), 0.05 (Table 4)
    Controls how far the natural image is perturbed. The epsilon sweep (Figure 3) shows performance rises then falls, but the chosen value differs across experiments without a principled rule.
  • oracle report composition probabilities = 80% abnormal, 10% normal, 10% original
    Hand-set to balance diversity and clinical relevance when sampling reports from the oracle LLM; no study of this ratio is provided.
  • query budget and iteration count = B=1500, 500 initial images, 3 iterations
    Engineering choice; results may depend on this specific budget.
  • fine-tuning learning rates = 5e-6 for IDEFICS, 1e-5 for CheXagent*
    Standard hyperparameters, but no sensitivity analysis is reported.
  • beam search diversity penalty and group settings = diversity penalty 0.2, 3 groups, 6 beams
    Decoding hyperparameters that affect the diversity and quality of generated reports.
assumptions (5)
  • domain assumption The victim model is deterministic and uses beam search decoding
    Stated in the Threat Model: the victim's predictions are deterministic under beam search, so repeated queries with the same image produce identical outputs.
  • domain assumption The attacker knows the exact instruction prompt T used by the victim
    The fixed prompt 'Write a structured Findings section...' is assumed known to the attacker; in a real black-box scenario this may be hidden.
  • ad hoc to paper The attacker model Ma is a faithful proxy for gradient transfer
    Domain Alignment section assumes that FGSM perturbations on Ma transfer to Mv, so the victim emits the enriched report. This is the core hypothesis and is not theoretically justified.
  • domain assumption The oracle LLM's text-only reports capture the relevant medical finding space
    The prompt To explicitly lists chest anatomy (airway, breathing, cardiac, etc.) and normal/abnormal descriptions; this requires medical knowledge and assumes the LLM produces clinically plausible text.
  • domain assumption Perturbed natural images lie near the medical image distribution in the victim's feature space
    The method assumes that CIFAR-100 plus adversarial noise is close enough to chest X-rays to make the victim produce useful reports, yet the Pa=MIMIC-CXR experiment (real X-rays) performs worse, so this assumption is not clearly supported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Medical Multimodal Model Stealing Attacks via Adversarial Domain Alignment." pith.science (2026). https://pith.science/paper/V5E5ITRR

@misc{pith2026250202438,
  author       = {Pith},
  title        = {Pith review of: Medical Multimodal Model Stealing Attacks via Adversarial Domain Alignment},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/V5E5ITRR}},
  note         = {Machine review of arXiv:2502.02438}
}
read the original abstract

Medical multimodal large language models (MLLMs) are becoming an instrumental part of healthcare systems, assisting medical personnel with decision making and results analysis. Models for radiology report generation are able to interpret medical imagery, thus reducing the workload of radiologists. As medical data is scarce and protected by privacy regulations, medical MLLMs represent valuable intellectual property. However, these assets are potentially vulnerable to model stealing, where attackers aim to replicate their functionality via black-box access. So far, model stealing for the medical domain has focused on classification; however, existing attacks are not effective against MLLMs. In this paper, we introduce Adversarial Domain Alignment (ADA-STEAL), the first stealing attack against medical MLLMs. ADA-STEAL relies on natural images, which are public and widely available, as opposed to their medical counterparts. We show that data augmentation with adversarial noise is sufficient to overcome the data distribution gap between natural images and the domain-specific distribution of the victim MLLM. Experiments on the IU X-RAY and MIMIC-CXR radiology datasets demonstrate that Adversarial Domain Alignment enables attackers to steal the medical MLLM without any access to medical data.

Figures

Figures reproduced from arXiv: 2502.02438 by the authors.

Figure 1
Figure 1. ADA-STEAL trains an attacker MLLM to repli￾cate a victim MLLM for radiology report generation from natural images by first enriching the reports and then align￾ing the attacker distribution to the medical domain. radiology image (e.g., chest X-ray) as input and generates a detailed diagnostic report. Since medical data is usually not publicly available and medical expertise is scarce, a well￾performing medical MLLMs… view at source ↗
Figure 2
Figure 2. The overview of our proposed approach with three iterative phases: (I) attacker model training, (II) medical report [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Left: performance of ADA-STEAL on IDEFICS with different ϵ across three metrics compared to the victim. Right: ablation study compares the performance of three attackers [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Qualitative evaluation by GPT-4 comparing the [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Left: Example of an image and pseudo-report pair from the Mushroom class in CIFAR-100. The abnormality is [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: shows the ability of our method with a more pow￾erful oracle model, GPT-4. Compared to using ZEPHYR-7B, the improved performance on both the MIMIC-CXR and IU X-RAY datasets emphasize the effectiveness of our de￾sign in enriching the medical report with an oracle LLM. W…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 35 canonical work pages

  1. [1]

    Buciluǎ, C.; Caruana, R.; and Niculescu-Mizil, A. 2006. Model compression. In ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD)

    work page 2006

  2. [2]

    Chen, Z.; Luo, X.; Wu, J.; Chan, D.; Lei, Z.; Wang, J.; Ourselin, S.; and Liu, H. 2024 a . VS-Assistant: Versatile Surgery Assistant on the Demand of Surgeons. arXiv preprint arXiv:2405.08272

    arXiv 2024

  3. [3]

    Chen, Z.; Shen, Y.; Song, Y.; and Wan, X. 2021. Cross-modal Memory Networks for Radiology Report Generation. In Association for Computational Linguistics (ACL)

    work page 2021

  4. [4]

    Chen, Z.; Song, Y.; Chang, T.-H.; and Wan, X. 2020. Generating Radiology Reports via Memory-driven Transformer. In the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)

    work page 2020

  5. [5]

    V.; Valanarasu, J

    Chen, Z.; Varma, M.; Delbrouck, J.-B.; Paschali, M.; Blankemeier, L.; Veen, D. V.; Valanarasu, J. M. J.; Youssef, A.; Cohen, J. P.; Reis, E. P.; Tsai, E. B.; Johnston, A.; Olsen, C.; Abraham, T. M.; Gatidis, S.; Chaudhari, A. S.; and Langlotz, C. 2024 b . CheXagent: Towards a Foundation Model for Chest X-Ray Interpretation. arXiv preprint arXiv:2401.12208

    arXiv 2024

  6. [6]

    Choi, Y.; Choi, J.; El-Khamy, M.; and Lee, J. 2020. Data-free network quantization with adversarial knowledge distillation. In Conference on Computer Vision and Pattern Recognition (CVPR)

    work page 2020

  7. [7]

    D.; Rosenman, M

    Demner-Fushman, D.; Kohli, M. D.; Rosenman, M. B.; Shooshan, S. E.; Rodriguez, L.; Antani, S.; Thoma, G. R.; and McDonald, C. J. 2016. Preparing a collection of radiology examinations for distribution and retrieval. Journal of the American Medical Informatics Association (JAMIA)

    work page 2016

  8. [8]

    Fang, G.; Song, J.; Shen, C.; Wang, X.; Chen, D.; and Song, M. 2019. Data-free adversarial distillation. arXiv preprint arXiv:1912.11006

    arXiv 2019

Show all 45 references
  1. [9]

    J.; Shlens, J.; and Szegedy, C

    Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2015. Explaining and Harnessing Adversarial Examples. In International Conference on Learning Representations (ICLR)

    2015

  2. [10]

    Hinton, G.; Vinyals, O.; and Dean, J. 2015. Distilling the knowledge in a neural network. In Advances in Neural Information Processing Systems (NeurIPS) Deep Learning Workshop

    2015

  3. [11]

    Huang, X.; Wang, X.; Zhang, H.; Xi, J.; An, J.; Wang, H.; and Pan, C. 2024. Cross-Modality Jailbreak and Mismatched Attacks on Medical Multimodal Large Language Models. arXiv preprint arXiv:2405.20775

    2024 arXiv

  4. [12]

    Irvin, J.; Rajpurkar, P.; Ko, M.; Yu, Y.; Ciurea-Ilcus, S.; Chute, C.; Marklund, H.; Haghgoo, B.; Ball, R.; Shpanskaya, K.; et al. 2019. Chexpert: A large chest radiograph dataset with uncertainty labels and expert comparison. In AAAI conference on artificial intelligence (AAAI)

    2019

  5. [13]

    Q.; Duong, D

    Jain, S.; Agrawal, A.; Saporta, A.; Truong, S. Q.; Duong, D. N.; Bui, T.; Chambon, P.; Zhang, Y.; Lungren, M. P.; Ng, A. Y.; et al. 2021. Radgraph: Extracting clinical entities and relations from radiology reports. In Advances in Neural Information Processing Systems (NeurIPS)

    2021

  6. [14]

    H.; Lauber, M

    Jia, S.; Bit, S.; Searls, E.; Claus, L.; Fan, P.; Jasodan; , V. H.; Lauber, M. V.; Veerapaneni, D.; Wang, W. M.; Au, R.; and Kolachalama, V. B. 2024. MedPodGPT : A multilingual audio-augmented large language model for medical research and education. medRxiv

    2024

  7. [15]

    E.; Pollard, T

    Johnson, A. E.; Pollard, T. J.; Berkowitz, S. J.; Greenbaum, N. R.; Lungren, M. P.; Deng, C.-y.; Mark, R. G.; and Horng, S. 2019. MIMIC-CXR, a de-identified publicly available database of chest radiographs with free-text reports. Scientific data

    2019

  8. [16]

    Kariyappa, S.; and Qureshi, M. K. 2020. Defending against model stealing attacks with adaptive misinformation. In Conference on Computer Vision and Pattern Recognition (CVPR)

    2020

  9. [17]

    S.; Parikh, A

    Krishna, K.; Tomar, G. S.; Parikh, A. P.; Papernot, N.; and Iyyer, M. 2020. Thieves on sesame street! model extraction of bert-based apis. In International Conference on Learning Representations (ICLR)

    2020

  10. [18]

    Krizhevsky, A. 2009. Learning multiple layers of features from tiny images. University of Toronto

    2009

  11. [19]

    Lauren c on, H.; Saulnier, L.; Tronchon, L.; Bekman, S.; Singh, A.; Lozhkov, A.; Wang, T.; Karamcheti, S.; Rush, A.; Kiela, D.; et al. 2024. Obelics: An open web-scale filtered dataset of interleaved image-text documents. In Advances in Neural Information Processing Systems (NeurIPS)

    2024

  12. [20]

    Lin, C.-Y. 2004. ROUGE : A Package for Automatic Evaluation of Summaries. In Association for Computational Linguistics (ACL)

    2004

  13. [21]

    Liu, X.; Zhu, Y.; Lan, Y.; Yang, C.; and Qiao, Y. 2024. Safety of Multimodal Large Language Models on Images and Text. In International Joint Conference on Artificial Intelligence (IJCAI)

    2024

  14. [22]

    E.; Pham, P

    Maas, A.; Daly, R. E.; Pham, P. T.; Huang, D.; Ng, A. Y.; and Potts, C. 2011. Learning word vectors for sentiment analysis. In Association for Computational Linguistics (ACL), 142--150

    2011

  15. [23]

    Mazeika, M.; Li, B.; and Forsyth, D. 2022. How to steer your adversary: Targeted and efficient model stealing defenses with gradient redirection. In International Conference on Machine Learning (ICML)

    2022

  16. [24]

    Micaelli, P.; and Storkey, A. J. 2019. Zero-shot knowledge transfer via adversarial belief matching. In Advances in Neural Information Processing Systems (NeurIPS)

    2019

  17. [25]

    P.; and Rajpurkar, P

    Moor, M.; Huang, Q.; Wu, S.; Yasunaga, M.; Dalmia, Y.; Leskovec, J.; Zakka, C.; Reis, E. P.; and Rajpurkar, P. 2023. Med-flamingo: a multimodal medical few-shot learner. In Machine Learning for Health (ML4H). PMLR

    2023

  18. [26]

    J.; Augustin, M.; Schiele, B.; and Fritz, M

    Oh, S. J.; Augustin, M.; Schiele, B.; and Fritz, M. 2018. Towards Reverse-Engineering Black-Box Neural Networks. In International Conference on Learning Representations (ICLR)

    2018

  19. [27]

    Orekondy, T.; Schiele, B.; and Fritz, M. 2019 a . Knockoff Nets: Stealing Functionality of Black-Box Models. In Conference on Computer Vision and Pattern Recognition (CVPR)

    2019

  20. [28]

    Orekondy, T.; Schiele, B.; and Fritz, M. 2019 b . Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks. In International Conference on Learning Representations (ICLR)

    2019

  21. [29]

    Pellegrini, C.; \"O zsoy, E.; Busam, B.; Navab, N.; and Keicher, M. 2023. RaDialog: A Large Vision-Language Model for Radiology Report Generation and Conversational Assistance. arXiv preprint arXiv:2311.18681

    2023 arXiv

  22. [30]

    Schlarmann, C.; and Hein, M. 2023. On the adversarial robustness of multi-modal foundation models. In International Conference on Computer Vision (ICCV)

    2023

  23. [31]

    K.; and Ren, H

    Seenivasan, L.; Islam, M.; Krishna, A. K.; and Ren, H. 2022. Surgical-vqa: Visual question answering in surgical scenes using transformer. In International Conference on Medical Image Computing and Computer-Assisted Intervention (MICCAI)

    2022

  24. [32]

    Y.; and Lungren, M

    Smit, A.; Jain, S.; Rajpurkar, P.; Pareek, A.; Ng, A. Y.; and Lungren, M. 2020. Combining Automatic Labelers and Expert Annotations for Accurate Radiology Report Labeling Using BERT. In Empirical Methods in Natural Language Processing (EMNLP)

    2020

  25. [33]

    K.; and Ristenpart, T

    Tram \`e r, F.; Zhang, F.; Juels, A.; Reiter, M. K.; and Ristenpart, T. 2016. Stealing Machine Learning Models via Prediction API s. In USENIX Security

    2016

  26. [34]

    J.; and Papernot, N

    Truong, J.-B.; Maini, P.; Walls, R. J.; and Papernot, N. 2021. Data-Free Model Extraction. In Conference on Computer Vision and Pattern Recognition (CVPR)

    2021

  27. [35]

    Tunstall, L.; Beeching, E.; Lambert, N.; Rajani, N.; Rasul, K.; Belkada, Y.; Huang, S.; von Werra, L.; Fourrier, C.; Habib, N.; et al. 2023. Zephyr: Direct distillation of lm alignment. arXiv preprint arXiv:2310.16944

    2023 arXiv

  28. [36]

    van der Maaten, L.; and Hinton, G. 2008. Visualizing Data using t-SNE. Journal of Machine Learning Research (JMLR)

    2008

  29. [37]

    Wang, B.; and Gong, N. Z. 2018. Stealing hyperparameters in machine learning. In IEEE Symposium on Security and Privacy (IEEE S&P)

    2018

  30. [38]

    L.; Navab, N.; Srivastav, V.; and Padoy, N

    Yuan, K.; Kattel, M.; Lavanchy, J. L.; Navab, N.; Srivastav, V.; and Padoy, N. 2024 a . Advancing surgical VQA with scene graph knowledge. International Journal of Computer Assisted Radiology and Surgery

    2024

  31. [39]

    Yuan, K.; Srivastav, V.; Navab, N.; and Padoy, N. 2024 b . Procedure-Aware Surgical Video-language Pretraining with Hierarchical Knowledge Augmentation. In Advances in Neural Information Processing Systems (NeurIPS)

    2024

  32. [40]

    Yuan, K.; Srivastav, V.; Yu, T.; Lavanchy, J.; Mascagni, P.; Navab, N.; and Padoy, N. 2023. Learning Multi-modal Representations by Watching Hundreds of Surgical Video Lectures. arXiv preprint arXiv:2307.15220

    2023 arXiv

  33. [41]

    Zhang, K.; Yu, J.; Yan, Z.; Liu, Y.; Adhikarla, E.; Fu, S.; Chen, X.; Chen, C.; Zhou, Y.; Li, X.; et al. 2023. BiomedGPT: a unified and generalist biomedical generative pre-trained transformer for vision, language, and multimodal tasks. arXiv preprint arXiv:2305.17100

    2023 arXiv

  34. [42]

    Q.; and Artzi, Y

    Zhang, T.; Kishore, V.; Wu, F.; Weinberger, K. Q.; and Artzi, Y. 2019. BERTScore: Evaluating Text Generation with BERT. In International Conference on Learning Representations (ICLR)

    2019

  35. [43]

    Zhuang, Z.; Nicolae, M.-I.; and Fritz, M. 2024. Stealthy Imitation: Reward-guided Environment-free Policy Stealing. In International Conference on Machine Learning (ICML)

    2024

  36. [44]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all...

  37. [45]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.